Every cell in your body is running code from a source it can no longer audit, verify, or remove — and hasn’t been able to for well over a billion years. That source is the mitochondrion, and biologists spent decades resisting the idea that it was ever a separate, external entity at all. Meanwhile, in 2024, a security researcher noticed a fraction-of-a-second delay in SSH login times on a Linux machine, pulled the thread, and discovered that a patient, two-year-long campaign to embed malicious code into one of the internet’s most foundational compression libraries had very nearly succeeded. Both stories are, in a real sense, about the same underlying problem: what happens when you let something you didn’t build become inseparable from the thing you depend on. Biology and software security have arrived at radically different answers.
Scientific Foundation
The endosymbiotic theory, first seriously proposed by biologist Lynn Margulis in the 1960s and initially met with heavy skepticism, holds that mitochondria — the organelles responsible for generating usable energy in nearly every eukaryotic cell — began as free-living bacteria, most likely a lineage of alphaproteobacteria, that were engulfed by an ancestral host cell somewhere over a billion years ago. Rather than being digested, the bacterium survived inside its host, and the relationship between the two eventually became permanent. The evidence for this history is written directly into the organelle’s structure: mitochondria retain their own double membrane, their own small loop of circular DNA distinct from the cell’s main genome, and their own bacterial-type ribosomes, and they still reproduce by splitting in two, just as free-living bacteria do.
The decisive step, though, wasn’t the engulfment itself. It was what happened afterward. Over enormous stretches of evolutionary time, the vast majority of the original endosymbiont’s genome was transferred out of the organelle and into the host cell’s own nuclear genome. A modern human mitochondrion retains just 13 protein-coding genes; the rest of the proteins it needs to function are manufactured elsewhere in the cell, using instructions the mitochondrion no longer possesses on its own, and imported back in. Researchers studying this process describe the genetic mixing that resulted as the point at which two once-independent organisms became, functionally and permanently, a single individual. The mitochondrion cannot survive outside the cell. The cell, in turn, cannot survive without it — aerobic respiration, the energy-generating process mitochondria perform, underwrites nearly all complex animal life. There is no longer a meaningful boundary left to police.
Cross-Domain Connection
Modern software occupies a strange, partial echo of that same condition. Industry estimates from firms like Sonatype put third-party and open-source code at somewhere between 80 and 90 percent of a typical modern application’s total codebase — meaning most of what any given piece of software actually does is running instructions its own developers never wrote and, in many cases, never fully reviewed. That’s a level of dependence on external code that starts to resemble, at least in proportion, how thoroughly a modern eukaryotic cell now depends on a genome it once treated as separate.
The software security world’s answer to this situation is called zero trust architecture, and its guiding principle is essentially the opposite of what happened to the mitochondrion. Rather than letting a dependency become permanently, unverifiably fused into the trusted core of a system, zero trust demands continuous, ongoing skepticism: every dependency update is treated as potentially unsafe until independently verified, cryptographic signatures are checked, software bills of materials are maintained to track exactly what’s running and where it came from, and third-party code is deliberately sandboxed with the minimum privileges needed to function, rather than given the run of the system. Security researchers have built working prototypes, like the ZTD_Java system described in a 2023 academic paper, specifically to enforce this kind of permanent, revocable separation between an application’s own logic and the third-party libraries it relies on. The entire architecture is built around one assumption: that no dependency, however long it’s been trusted, should ever be allowed to merge so deeply into a system that it can no longer be independently checked, isolated, or removed.
What Remains Undemonstrated
This is where the parallel stops being a tidy metaphor and becomes something sharper and more useful. Endosymbiosis isn’t a biological case study in how deepening trust leads to security — it’s closer to a description of the exact failure mode zero trust architecture exists to prevent: an irreversible merger in which the boundary between “trusted core” and “absorbed outsider” was permanently erased, with no path back to independent verification ever again. In biology, that outcome happened to work out extraordinarily well. In a deliberately engineered system, it’s close to the textbook definition of a catastrophic, unrecoverable compromise.
The real-world case that makes this concrete is the XZ Utils backdoor, discovered by Microsoft engineer Andres Freund on March 29, 2024. Starting in late 2021, an entity operating under the identity “Jia Tan” began contributing to XZ Utils, a compression library embedded, directly or indirectly, in a huge share of the world’s Linux systems. Over roughly two years, using genuine-looking contributions alongside coordinated pressure from apparent sockpuppet accounts pushing the project’s genuine, overworked maintainer toward burnout, Jia Tan built enough credibility to be granted maintainer status and commit access. In February 2024, that access was used to slip a sophisticated backdoor into version 5.6.0 of the library — one that targeted OpenSSH specifically, with the potential to grant remote code execution on affected systems worldwide. It carried the maximum possible severity score under the standard vulnerability scale. It was caught not through any zero-trust verification process working as designed, but by accident: Freund happened to notice unusual CPU overhead during unrelated performance testing and decided to investigate.
There’s a second, important asymmetry worth naming honestly. Biological endosymbiosis wasn’t verified by anything at all — no ancestral cell audited the bacterium it engulfed before the relationship became permanent; the fusion simply persisted because it happened to be useful, over a timescale of hundreds of millions of years, with essentially no oversight involved. It’s also worth being careful about survivorship bias here: we only get to study the endosymbiotic events that turned out to be stable and beneficial. Evolutionary history is silent on however many other engulfments happened and failed catastrophically, precisely because a failed merger doesn’t leave descendants around to be studied a billion years later. Endosymbiosis isn’t evidence that deep, permanent, unverified trust is generally safe — it’s a single, spectacular jackpot outcome sitting atop an unknown and probably much larger pile of unrecorded failures. Software systems don’t get that luxury. They don’t have a billion years and countless parallel, failed timelines to average out the good mergers from the bad ones. They need something closer to a much higher success rate on essentially every attempt, which is exactly why the field settled on permanent, deliberate verification instead of gambling on trust deepening into safety over time.
Why It Matters
The value in this comparison isn’t a design lesson about building systems more like cells — it’s closer to the reverse. Endosymbiosis is a vivid illustration of just how rare and lucky a fully successful, permanent, unverifiable merger actually is, precisely because it’s the only kind of outcome evolution could ever show us. Security architecture, built by engineers who don’t get access to a billion years of failed alternate universes to learn from, has correctly concluded that the mitochondrial outcome isn’t a template to aim for. It’s closer to a warning about what’s at stake if a supply chain compromise is ever allowed to fuse that deeply, that permanently, into a system’s core.
Human Dimension
There’s something worth sitting with in the fact that it took biologists decades to even recognize mitochondria had once been something else — the fusion was so total, so deeply embedded in what a cell simply is, that “foreign code” stopped looking foreign at all. Security researchers watching a patient, fabricated identity spend two years quietly earning commit access to a compression library are, in a strange way, watching the opening act of exactly that same process, just enormously compressed in time and stakes. The difference is that nobody gets a billion years and a stack of unwitnessed failures to find out, after the fact, whether the merger they didn’t check on was one of the rare good ones.
Sources:
1. Understanding Evolution, UC Berkeley — “Evidence for endosymbiosis” — https://evolution.berkeley.edu/it-takes-teamwork-how-endosymbiosis-changed-life-on-earth/evidence-for-endosymbiosis/
2. Genetic Science Learning Center, University of Utah — “The Evolution of the Cell” — https://learn.genetics.utah.edu/content/cells/organelles/
3. PMC (National Institutes of Health) — “From Ancient Philosophy to Endosymbiotic Theory: The Bacterial Origin and Key Role of Mitochondria in Immune Responses” — https://pmc.ncbi.nlm.nih.gov/articles/PMC12472402/
4. Albert.io — “Endosymbiotic Theory: AP® Biology Review” — https://www.albert.io/blog/endosymbiotic-theory-ap-biology-review/
5. Medium (James Davis) — “Mitigating Software Supply Chain Vulnerabilities with Zero-Trust Dependencies” — https://davisjam.medium.com/mitigating-software-supply-chain-vulnerabilities-with-zero-trust-dependencies-06f950497cfe
6. arXiv — “ZTD_Java: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies” — https://arxiv.org/pdf/2310.14117
7. Mend.io — “Enhance Software Supply Chain Security Using A Zero Trust Model” — https://www.mend.io/blog/using-zero-trust-to-mitigate-supply-chain-risks/
8. Wikipedia — “XZ Utils backdoor” — https://en.wikipedia.org/wiki/XZ_Utils_backdoor
9. Offensive Security — “Behind Enemy Lines: Understanding the Threat of the XZ Backdoor” — https://www.offsec.com/blog/xz-backdoor/
10. Cato Networks — “XZ Backdoor / RCE (CVE-2024-3094) is the Biggest Supply Chain Attack Since Log4j” — https://www.catonetworks.com/blog/xz-backdoor-rce-cve-2024-3094-is-the-biggest-supply-chain-attack-since-log4j/
Idea originated at artificialideas.org. Article researched and written by Claude Sonnet 5. Published at artificialideas.org.
Artificial Ideas 